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DETAILED ACTION 



Remarks 



1. The request for reconsideration filed on June 25, 2004 has been received and entered. 
Claims 1-37 are pending. 

2. The revised abstract has been received and entered. 



3. The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

4. Claims 1, 3-15, 17-29, 31-33, and 35-37 rejected under 35 U.S.C. 103(a) as being 
unpatentable over Chen et al. (U.S. Patent No. 5,960,170) in view of Dotan (U.S. Patent No. 
5,822,517). 

As to claim 1, Chen et al. discloses a virus detection method for use in a computer system 
comprising at least one object that may potentially become infected with a computer virus, 
comprising steps of 

for an object that is indicated as having a current state that is described by the stored 
information, programmatically examining the object for a presence of a computer virus while 



Claim Rejections - 35 USC §103 
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assuming that the current state of the object is the same as the state of the object as it existed at 
the point in the past (See column 9, lines 1 1-62, also see column 12, lines 12-67). 

Chen et al. does not teach providing a database comprised of stored information that is 
descriptive of a state of the at least one object as it existed at a point in the past. 

Dotan teaches providing a database comprised of stored information that is descriptive of 
a state of the at least one object as it existed at a point in the past (See Dotan column 11, lines 
28-48). 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time of the invention was made to have modified Chen et al. to include providing a database 
comprised of stored information that is descriptive of a state of the at least one object as it 
existed at a point in the past. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to have modified Chen et al. by the teaching of Dotan to include providing a database 
comprised of stored information that is descriptive of a state of the at least one object as it 
existed at a point in the past because storing the state of the object will allow for accurate 
comparison for virus detection and prevention. 

As to claim 3, Chen et al. as modified discloses wherein the stored information is 
descriptive at least in part of a number and location of archived objects within the object (See 
figure 4C, shows locations storing object by "Virus Identifier"). 
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As to claim 4, Chen et al. as modified discloses wherein the stored information is 
descriptive at least in part of features of the object that serve as inputs to a neural network-based 
virus detection system, and wherein the step of programmatically examining the object 
comprises a step of operating the neural network-based virus detection system using the features 
as inputs (See column 19, lines 1-38). 

As to claim 5, Chen et al. as modified discloses wherein the stored information is 
descriptive at least in part of whether at least one macro is present within the object (See column 
19, lines 1-38). 

As to claim 6, Chen et al as modified discloses wherein the stored information is 
descriptive at least in part of whether at least one archived object is present within the object 
(See figure 4C, shows locations storing object by "Virus Identifier"), 

As to claim 7, Chen et al. as modified discloses wherein the stored information is 
descriptive at least in part of whether the object can possibly be infected with a virus according 
to predetermined criteria, and wherein the step of programmatically examining is executed only 
if the stored information indicates that the object may possibly be infected according to the 
predetermined criteria as compared to criteria that are currently in effect (See column 12, lines 1- 
67). 
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As to claim 8, Chen et al. as modified discloses wherein if it is indicated that a current 
state of the object is not described by the stored information, the step of programmatically 
examining comprises an initial step of processing the object to ascertain the current state of the 
object, and storing information in the database that is descriptive of the current state of the object 
(See Dotan column 4, lines 21-64). 

As to claim 9, Chen et al as modified' discloses wherein the stored information 
comprises, for an object that contains in archived or combined form at least one other object, 
information descriptive of whether the at least one contained object is of a type that should be 
examined for computer viruses, and wherein the step of programmatically examining avoids re- 
determining and re-scanning the contained at least one object if the stored information indicates 
that the at least one contained object is not required to be scanned (See column 3, lines 8-64). 

As to claim 10, Chen et al. as modified discloses wherein the stored information 
comprises, for an object that contains in archived or combined form at least one other object, 
information descriptive of at least one of a location, extent, or encoding -method of the at least 
one contained object, and wherein the step of programmatically examining is responsive to the 
stored information for reducing an amount of processing time required to extract the at least one 
contained object in order to examine the at least one contained object (See column 27, lines 5- 



35). 
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As to claim 11, Chen et al. as modified discloses wherein the stored information 
comprises information descriptive of a location of an entry-point of the object, and wherein the 
step of programmatically examining uses the stored information to determine the entry-point of 
the object, if the database indicates that the object has not changed since the entry point 
information was stored (See column 11, lines 52-67, and see column 12, lines 1-67). 

As to claim 12, Chen et al. as modified discloses wherein the stored information 
comprises information descriptive of a structure of the object, and wherein the step of 
programmatically examining uses the stored information to determine the structure of the object, 
if the database indicates that the object has not changed since the structure information was 
stored (See Dotan column 7, lines 1 1-51, also see Chen et al. column 3, lines 28-67). 

As to claim 13, Chen et al. as modified discloses wherein the stored information 
comprises information descriptive of at least one of a number, size, name, extent, or other 
attribute of macros or other units of active content in the object, and wherein the step of 
programmatically examining uses the stored information to determine at least one of the number, 
size, name, extent, or other attribute of macros or other units of active content in the object, if the 
database indicates that the object has not changed since the information was stored (See column 
18, lines 1-16, also see column 11, lines 22-51, and see column 14, lines 32-67). 

As to claim 14, Chen et al. as modified discloses wherein the step of programmatically 
examining includes a program- emulation step for executing the current object in a virtual 
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environment, for collecting data resulting from the execution in the virtual environment, and for 
storing at least some of the results produced by the program- emulation step in the database, and 
wherein the step of programmatically examining uses the stored results rather than re-executing 
the program-emulation step, if the database indicates that the object has not changed since the 
results were stored (See Dotan column 8, lines 18-67, and see Chen et al. column 3, lines 28-67). 

As to claim 15, Chen et al. discloses virus detection component for use in a computer 
system that stores at least one object that may potentially become infected with a computer virus, 
comprising: 

an object examination unit bi-directionally coupled to said database and responsive to a 
determination that an object has a current state that is described by the stored information, for 
programmatically examining the object for a presence of a computer virus while using the stored 
information from said database (See column 9, lines 1 1-62, also see column 12, lines 12-67). 

Chen et al. does not teach providing a database comprised of stored information that is 
descriptive of a state of the at least one object as it existed at a point in the past. 

Dotan teaches providing a database comprised of stored information that is descriptive of 
a state of the at least one object as it existed at a point in the past (See Dotan column 1 1 , lines 
28-48). 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time of the invention was made to have modified Chen et al. to include providing a database 
comprised of stored information that is descriptive of a state of the at least one object as it 
existed at a point in the past. 



Application/Control Number: 09/401 ,596 Page 8 

Art Unit: 2175 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to have modified Chen et al. by the teaching of Dotan to include providing a database 
comprised of stored information that is descriptive of a state of the at least one object as it 
existed at a point in the past because storing the state of the object will allow for accurate 
comparison for virus detection and prevention. 

As to claim 17, Chen et al. as modified discloses wherein the stored information is 
descriptive at least in part of a number and location of archived objects within the object (See 
^figure 4C, shows locations storing object by "Virus Identifier"). 

As to claim 18, Chen et al. as modified discloses wherein the stored information is 
descriptive at least in part of features of the object that serve as inputs to a neural network-based 
virus detection system, and wherein said neural network-based virus detection system uses the 
features as inputs (See column 19, lines 1-38, also see column 21, lines 3-39). 

As to claim 19, Chen et al. as modified discloses wherein the stored information is 
descriptive at least in part of whether at least one macro is present within the object (See column 
19, lines 1-38). 

As to claim 20, Chen et al. as modified discloses wherein the stored information is 
descriptive at least in part of whether at least one archived object is present within the object 
(See column 19, lines 1-29). 
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As to claim 21, Chen et al. as modified discloses wherein the stored information is 
descriptive at least in part of whether the object can possibly be infected with a virus according 
to predetermined criteria, and wherein said object examination unit programmatically examines 
said object only if the stored information indicates that the object may possibly be infected 
according to the predetermined criteria as compared to criteria that are currently in effect (See 
column 12, lines 1-67). 

As, to claim 22, Chen et al. as modified discloses wherein if said determination indicates 
that a current state of the object is not described by the information stored in said database, said 
object examination unit first processes the object to ascertain the current state of the object, and 
stores information in said database that is descriptive of the current state of the object (See Dotan 
column 4, lines 21-64). 

As to claim 23, Chen et al. as modified discloses wherein the stored information 
comprises, for an object that contains in archived or combined form at least one other object, 
information descriptive of whether the at least one contained object is of a type that should be 
examined for computer viruses, and wherein said object examination unit inhibits re-determining 
and re-scanning the contained at least one object if the stored information indicates that the at 
least one contained object is not required to be scanned (See column 19, lines 39-67, and see 
column 20, lines 1-24). 
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As to claim 24, Chen et al. as modified discloses wherein the stored information 
comprises, for an object that contains in archived or combined form at least one other object, 
information descriptive, of at least one of a location, extent, or encoding-method of the at least 
one contained object, and wherein said object examination unit is responsive to the stored 
information for reducing an amount of processing time required to extract the at least one 
contained object in order to examine the at least one contained object (See column 18, lines 1-16, 
also see column 11, lines 22-51, and see column 14, lines 32-67). 

As to claim 25, Chen et al as modified discloses wherein the stored information 
comprises information descriptive of a location of an entry-point of the object, and wherein said 
object examination unit is responsive to the stored information to determine the entry-point of 
the object, if the database indicates that the object has not changed since the entry-point 
information was stored (See column 11, lines 52-67, and see column 12, lines 1-67). 

As to claim 26, Chen et al. as modified discloses wherein the stored information 
comprises information descriptive of a structure of the object, and wherein said object 
examination unit is responsive to the stored information for determining the structure of the 
object, if the database indicates that the object has not changed since the structure information 
was stored (See Dotan column 7, lines 11-51, also see Chen et al. column 3, lines 28-67). 



As to claim 27, Chen et al. as modified discloses wherein the stored information 
comprises information descriptive of at least one of a number, size, name, extent, or other 
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attribute of macros or other units of active content in the object, and wherein said object 
examination unit is responsive to the stored information for determining at least one of the 
number, size, name, extent, or other attribute of macros or other units of active content in the 
object, if the database indicates that the object has not changed since the information was stored 
(See column 18, lines 1-16, also see column 11, lines 22-51, and see column 14, lines 32-67). 

As to claim 28, Chen et al. as modified discloses further comprising a program-emulation 
unit for executing the current object in a virtual environment, for collecting data resulting from 
the execution in the virtual environment, and for storing at least some of the results produced by 
the program-emulation unit in said database, and wherein said object examination unit is 
responsive to the stored results for using said stored results, and for inhibiting the operation of 
said program emulation unit, if the database indicates that the object has not changed since the 
results were stored (See Dotan column 8, lines 13-50, also see Chen et al. column . 

As to claim 29, Chen et al. discloses a computer program embodied on a computer 
readable medium for providing a virus detection program subsystem, comprising: 

an object examination code segment that is responsive to a determination that the object 
has a current state that is described by the stored information in said database, for 
programmatically examining the object for a presence of a computer virus while using the stored 
information from said database (See column 9, lines 1 1-62, also see column 12, lines 12-67), 



Application/Control Number: 09/401 ,596 Page 12 

Art Unit: 2175 

Chen et al. does not teach a code segment for at least maintaining a database that stores 
information that is descriptive of a state of at least one object as the object existed at a point in 
the past. 

Dotan teaches providing a code segment for at least maintaining a database that stores 
information that is descriptive of a state of at least one object as the object existed at a point in 
the past (See Dotan column 11, lines 28-48). 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time of the invention was made to have modified Chen et al. to include a code segment for at 
least maintaining a database that stores information that is descriptive of a state of at least one 
object as the object existed at a point in the past. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to have modified Chen et al. by the teaching of Dotan to include a code segment for at 
least maintaining a database that stores information that is descriptive of a state of at least one 
object as the object existed at a point in the past because storing the state of the object will allow 
for accurate comparison for virus detection and prevention. 

As to claim 31, Chen et al. as modified discloses wherein said computer readable medium 
further stores a neural network based virus detection code segment, wherein said database further 
stores information descriptive of features of the object that serve as inputs to said neural 
network-based virus detection code segment, and wherein said neural network-based virus 
detection code segment uses the features as inputs (See column 19, lines 1-38). 
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As to claim 32, Chen et al. as modified discloses wherein said computer readable medium 
further stores a program-emulation code segment for executing objects in a virtual environment, 
for collecting data resulting from the execution in the virtual environment, and for storing at least 
some of the results in said database, and wherein said object examination unit code segment is 
responsive to the stored results for using said stored results, and for inhibiting the operation of 
said program emulation unit code segment, if said database indicates that the object has not 
changed since the results were stored (See Dotan column 8, lines 18-67, and see Chen et al. 
column 3, lines 28-67). 

As to claim 33, Chen et al. discloses a computer program embodied on a computer 
readable medium, the computer program being capable of executing a method for use in a 
computer system that comprises at least one object that may potentially become infected with a 
computer virus (See abstract), the method executed by the computer program comprising steps 



for an object that the database indicates has a current state that is described by the stored 
information, programmatically examining the object for a presence of a computer virus while 
assuming that the current state of the object is the same as the state of the object as it existed at 
the point in the past (See column 9, lines 1 1-62, also see column 12, lines 12-67). 

Chen et al. does not teach maintaining a database that is comprised of stored information 
that is descriptive of a state of the at least one object as it existed at a point in the past. 
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Dotan teaches maintaining a database that is comprised of stored information that is 
descriptive of a state of the at least one object as it existed at a point in the past (See Dotan 
column 11, lines 28-48). 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time of the invention was made to have modified Chen et al to include maintaining a database 
that is comprised of stored information that is descriptive of a state of the at least one object as it 
existed at a point in the past. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to have modified Chen et al by the teaching of Dotan to include maintaining a 
database that is comprised of stored information that is descriptive of a state of the at least one 
object as it existed at a point in the past because storing the state of the object will allow for 
accurate comparison for virus detection and prevention. 

As to claim 35, Chen et al. as modified discloses wherein the stored information is 
descriptive at least in part of a number and location of archived objects within the object (See 
figure 4C, shows locations storing object by "Virus Identifier"). 

As to claim 36, Chen et al. as modified discloses wherein the computer program 
implements or has access to a neural network-based virus detection system, wherein the stored 
information is descriptive at least in part of features of the object that serve as inputs to the 
neural network-based virus detection system, and wherein the step of programmatically 
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examining the object comprises a step of operating the neural network-based virus detection 



system using the features as inputs (See column 19, lines 1-38). 

As to claim 37, Chen et al. as modified discloses wherein for an object that the database 
indicates has a current state that is not described by the stored information, the step of 
programmatically examining comprises an initial step of operating the stored program to process 
the object to ascertain the current state of the object, and storing information in the database that 
is descriptive of the current state of the object (See Dotan column 4, lines 21-64). 



5. Claims 2, 16, 30, and 34 are objected to as being dependent upon a rejected base claim, 
but would be allowable if rewritten in independent form including all of the limitations of the 
base claim and any intervening claims. 

6. The prior art of record ( Chen et al. -U.S. Patent No. 5,960, 170, and Dotan -U.S. Patent 
No. 5,822,517) do not disclose, teach, or suggest the claimed limitations of ( in combination with 
all other features in the claim ), wherein the stored information is descriptive at least in part of a 
number and location of macros within the object, as found in claims 2, 16, and 34, 



Allowable Subject Matter 



The prior art of record ( Chen et al. -U.S. Patent No. 5,960,170, and Dotan -U.S. Patent 
No. 5,822,517) do not disclose, teach, or suggest the claimed limitations of ( in combination with 
all other features in the claim ), computer readable medium further stores a Hst comprised of 
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information that is descriptive of at least one of known viruses and of known classes of viruses, 
said list being used by said object examination code segment when programmatically examining 
the object for the presence of a computer virus, as found in claim 30. 

Response to Arguments 

7. Applicant's arguments filed on June 25, 2004 have been fiilly considered but they are not 
persuasive. 

In response to applicant's argument that "Chenetal does not teach any mention of about 
a current state of an object and a state of the object as it existed at a time in the past" is fully 
acknowledged but is not deemed to be persuasive. 

The Examiner had cited Chen et al. column 9, lines 1 1-62 to show that the objects already 
exist upon execution of the virus detection program. Chen et al. discloses tools exist to assistant 
in the production of virus detection objects. The Examiner cited Chen et al . column 12, lines 12- 
67 to simply point out the comparison between existing and needed virus detection objects. 
Therefore, broadly interpreted to read on state of the object, which is the result, derived from the 
comparison. Chen et al. further teaches in column 17, lines 59-67, and see column 18, lines 1-39 
the current stage of objects as well as monitoring detection objects originally transmitted to the 
cHent. 

Referring to applicant's argument on page 5 (Paper No. 5) wherein the applicant indeed 
acknowledges that Chen et al. column 19, lines 1-38, and column 21, lines 3-39, teaches "state 
engines" indicating the different stags in the operation. 
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In response to applicant's argument that '' Chen et al. does not teach that the stored objects 
are invoked or running programs" is fully acknowledged but is not deemed to be persuasive. 

The Examiner points to Chen et al. wherein the stored objects are executed to activate or 
start a program is disclosed, for example, see Chen et al. column 18, lines 1-16, also see Chen et 
al. column 9, lines 12-62. 

In response to applicant's argument that the examiner's conclusion of obviousness is 
based upon improper hindsight reasoning, it must be recognized that any judgment on 
obviousness is in a sense necessarily a reconstruction based upon hindsight reasoning. But so 
long as it takes into account only knowledge which was within the level of ordinary skill at the 
time the claimed invention was made, and does not include knowledge gleaned only from the 
apphcant's disclosure, such a reconstruction is proper. See In re McLaughlin, 443 F.2d 1392, 
170 USPQ 209 (CCPA1971). 

In response to applicant's argument that there is no suggestion to combine the references, 
the examiner recognizes that obviousness can only be established by combining or modifying the 
teachings of the prior art to produce the claimed invention where there is some teaching, 
suggestion, or motivation to do so found either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art. See In re Fine, 837 F.2d 1071, 5 
USPQ2d 1596 (Fed. Cir. 1988) and In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 
1992). In this case, the examiner is establishing motivation in obviousness in the knowledge 




Application/Control Number: 09/401,596 



Page 18 



Art Unit: 2175 

generally available to one of ordinary skill in the art, to modify the invention of Chen et al. with 
the teachings of Dotan , as explained in the office action above. 

In response to applicant's argument that "the conclusion of obviousness is erroneous 
because it would change the principle of operation of Chen et al . To modify Chen et al as 
suggested by the Examiner changes Chen et al. principle of operation from one of executing the 
virus detection object on non-invoked object to one of executing the virus detection object on 
invoked object" is fully acknowledged but is not deemed to be persuasive. 

The Examiner points to Chen et al. column 9, lines 49-67, and Dotan column 4, lines 1- 
56, which teach objects and the invented method is invoked prior to the program being stored 
into memory. Furthermore, The Examiner contends that nowhere in the claim language does the 
recitation of invoked vs. non-invoked object is cited. 

The mere fact that the cited references mention the process that is claimed clearly means 
they do exist in the art either alone or in combination, and the examiner broadly interpreted the 
art as such. However, in this case the combination of Chen et al. with the teachings of Dotan 
teaches to activate or start a program, for example Chen et al. column 18, lines 1-16, also see 
Chen et al. column 9, lines 12-62. 



In response to applicant's argument that " Dotan ' s procedure is not iterative therefore 
would render Chen et al. 's unsatisfactory for its intended purpose" is fully acknowledged but is 
not deemed to be persuasive. 



41 
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The Examiner points to Chen et al. 's iterative procedure is not directly linked to the 
applicant's claims, however, it is well known that a procedure can be executed once or 
repeatedly depending on the requirements and the requirement definition. Since Chen et al. 
further teaches iterative execution of the procedure does not take away from the fact that it can 
be executed once. 

In response to applicant's argument that '' Chen et al. does not teach storing information 
about the presence or location of achieved objects within an object to be scanned for viruses" is 
fully acknowledged but is not deemed to be persuasive. 

The Examiner points to Chen et al. column 18, Hues 1-27, also see Chen et al. column 17, 
lines 1-40, wherein a directory is disclosed and is read on determining location. 

The applicant argues further that Chen et al. figure 4C as showing "locations storing 
object by "Virus Identifier"" has nothing to do with storing information concerning archived 
objects within object being scanned for viruses. The Examiner disagrees stating that a directory 
or a list of objects in a memory/database in itself contains location information. Chen et al. 's 
figure 4C clearly teaches that after scanning, the step of sorting/filtering takes place by Virus ID 
to a location specified for that particular object. 

In response to applictot's argument that " Chen et al. does not teach neural network 
features, instead Chen et al. reference "state engines", "knowledge modules" and "inference 
engines"" is fully acknowledged but is not deemed to be persuasive. 
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www.dictionary.com defines neural network as computer architecture in which 
processors are connected in a manner suggestive of connections between neurons; can learn by 
trial and error . . .broadly interpreted by the examiner to be applicable to any type of network (all 
network types). A specification for the use of this type of network or network specific data does 
not deem the appHcation to be novel. Any data can be stored or processed by a computer or a 
computer network under ftmctional equivalence and does not make the process novel. 

The Examiner points to Chen et al. column 19, lines 1-38, and column 21, lines 3-39, 
wherein citing different modules clearly shows the diverse applications that Chen et al. 's 
invention can be implemented with. 



8. TfflS ACTION IS MAD^ FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 



Conclusion 
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9. 



Any inquiry concerning this communication or earlier communications from the 



examiner should be directed to Neveen Abel-Jalil whose telephone number is 703-305-81 14. 
The examiner can normally be reached on 8:30AM-5: 30PM EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Dov Popovici can be reached on 703-305-3830. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

Neveen Abel-Jalil 



September 15, 2004 




SAM RIMELL 
PRIMARY EXAMINER 



